{"answers":{"affected":"10 open source packages ship an affected version, including litellm.","exploited":"There is no known exploitation of CVE-2026-114612 in the wild and no public exploit code.","fix":"Upgrade litellm to a fixed version for your release line: 1.101.3, 1.102.2, 1.103.1 or 1.104.0rc2.","what":"CVE-2026-114612 is a critical vulnerability in BerriAI litellm, published on 22 Oct 2026."},"fix_prompt":"Check this codebase for CVE-2026-114612 and fix it if it is affected.\n\nWhat it is: CVE-2026-114612 is a critical vulnerability in BerriAI litellm, published on 22 Oct 2026. \nExploitation: There is no known exploitation of CVE-2026-114612 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- litellm (PyPI): affected from 1.101.0; fixed in 1.101.3\n- litellm (PyPI): affected from 1.101.0; fixed in 1.101.3\n- litellm (PyPI): affected from 1.102.0; fixed in 1.102.2\n- litellm (PyPI): affected from 1.102.0; fixed in 1.102.2\n- litellm (PyPI): affected from 1.103.0; fixed in 1.103.1\n- litellm (PyPI): affected from 1.103.0; fixed in 1.103.1\n- litellm (PyPI): affected from 1.104.0rc1; fixed in 1.104.0rc2\n- litellm (PyPI): affected from 1.104.0rc1; fixed in 1.104.0rc2\n- litellm (PyPI): affected from 1.91.0; fixed in 1.100.4\n- litellm (PyPI): affected from 1.91.0; fixed in 1.100.4\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-114612/ (Markdown: https://insights.sbomify.com/CVE-2026-114612/index.md)","id":"CVE-2026-114612","markdown":"https://insights.sbomify.com/CVE-2026-114612/index.md","name":"CVE-2026-114612","record":{"aliases":["GHSA-7hp6-4w63-5g45"],"analysis":null,"analysis_generated_by":null,"assigner":"GitHub_M","cpe":[],"cvss":{"score":9.9,"severity":"critical","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"cwes":[{"id":"CWE-441","name":"Unintended Proxy or Intermediary"},{"id":"CWE-345","name":"Insufficient Verification of Data Authenticity"},{"id":"CWE-269","name":"Improper Privilege Management"}],"description":"LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From 1.87.0 until 1.100.4, 1.101.3, 1.102.2, 1.103.1, and 1.104.0-rc.2, the proxy reuses one cryptographic context for at-rest secrets and session tokens, allowing an authenticated internal user to have crafted metadata containing a forged administrator credential encrypted and returned by the API-key flow. Replaying that ciphertext as a bearer token causes the proxy to trust the forged proxy administrator identity, permitting administrative access and arbitrary commands through the MCP stdio endpoint. Versions 1.87.0 through 1.90.x require EXPERIMENTAL_UI_LOGIN to be enabled, while versions after 1.91.0 are exploitable in the default configuration. This issue was fixed in LiteLLM 1.100.4, 1.101.3, 1.102.2, 1.103.1, and 1.104.0-rc.2.","ecosystems":["PyPI"],"exploits":{"exploitdb":0,"first_seen":"2026-10-24","github_poc":1,"max_poc_stars":0,"metasploit":0,"nuclei":0,"refs":[{"date":"2026-10-24T15:18:04Z","kind":"github_poc","ref":"https://github.com/Hunt-Benito/one-salt-to-forge-them-all-cve-2026-114612-forged-admin-session-in-litellm","stars":0,"title":null}],"tier":"poc_unverified"},"has_fix":true,"headline":"LiteLLM: Privilege Escalation to Proxy Admin via Cross-Domain Reuse of the Salt Key","id":"CVE-2026-114612","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"PyPI","product":null,"products":[],"type":null,"year":"2026"},"n_packages":10,"n_references":11,"next":{"headline":"MessagePack: Unbounded memory leak in msgpack C extension on strict_map_key validation failure","id":"CVE-2026-114613"},"packages":[{"ecosystem":"PyPI","fixed":["1.101.3"],"introduced":["1.101.0"],"last_affected":[],"package":"litellm","purl":null,"source":"GHSA-7hp6-4w63-5g45"},{"ecosystem":"PyPI","fixed":["1.101.3"],"introduced":["1.101.0"],"last_affected":[],"package":"litellm","purl":"pkg:pypi/litellm","source":"GHSA-7hp6-4w63-5g45"},{"ecosystem":"PyPI","fixed":["1.102.2"],"introduced":["1.102.0"],"last_affected":[],"package":"litellm","purl":null,"source":"GHSA-7hp6-4w63-5g45"},{"ecosystem":"PyPI","fixed":["1.102.2"],"introduced":["1.102.0"],"last_affected":[],"package":"litellm","purl":"pkg:pypi/litellm","source":"GHSA-7hp6-4w63-5g45"},{"ecosystem":"PyPI","fixed":["1.103.1"],"introduced":["1.103.0"],"last_affected":[],"package":"litellm","purl":null,"source":"GHSA-7hp6-4w63-5g45"},{"ecosystem":"PyPI","fixed":["1.103.1"],"introduced":["1.103.0"],"last_affected":[],"package":"litellm","purl":"pkg:pypi/litellm","source":"GHSA-7hp6-4w63-5g45"},{"ecosystem":"PyPI","fixed":["1.104.0rc2"],"introduced":["1.104.0rc1"],"last_affected":[],"package":"litellm","purl":null,"source":"GHSA-7hp6-4w63-5g45"},{"ecosystem":"PyPI","fixed":["1.104.0rc2"],"introduced":["1.104.0rc1"],"last_affected":[],"package":"litellm","purl":"pkg:pypi/litellm","source":"GHSA-7hp6-4w63-5g45"},{"ecosystem":"PyPI","fixed":["1.100.4"],"introduced":["1.91.0"],"last_affected":[],"package":"litellm","purl":null,"source":"GHSA-7hp6-4w63-5g45"},{"ecosystem":"PyPI","fixed":["1.100.4"],"introduced":["1.91.0"],"last_affected":[],"package":"litellm","purl":"pkg:pypi/litellm","source":"GHSA-7hp6-4w63-5g45"}],"prev":{"headline":"OCO-Server is a self-hosted endpoint management application for computer inventory, software deployment, and mobile device management.","id":"CVE-2026-114611"},"products":["litellm"],"published":"2026-10-22","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"},{"class":"open","licence":"CC0","name":"PoC-in-GitHub"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-10-22","vendors":["BerriAI"]},"summary":null,"url":"https://insights.sbomify.com/CVE-2026-114612/"}